Staff Register of Interests and Gifts & Hospitality City of York Council Internal Audit Report 2015/16

Directorate: Customer and Business Support Services Responsible Officer: AD – Customers and Employees Service Manager: Executive Support Assistant to Chief Executive Date Issued: 26th July 2016 Status: Final Reference: 19100/003

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Limited Assurance | Summary and Overall Conclusions

Introduction In accordance with the council’s Employee Code of Conduct, all employees are required to declare any personal interests which may conflict with the interests of the council or adversely affect the performance of their duties. Such disclosure protects employees from accusations of impropriety. Declarations should be made in accordance with guidance notes on registers of interests and declarations of conflicts of interests. A confidential register is held centrally in the business support hub.

Additionally, each directorate should hold a register or registers to record offers of gifts and hospitality along with details of rejection, or acceptance and subsequent distribution.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to management and members that procedures and controls within the system will ensure that:

• registers are kept and completed in accordance with guidelines and these are easily accessible to staff • declarations of interest are made by all relevant staff • registers are reviewed regularly by appropriate officers • information about staff interests is held securely and cannot be accessed inappropriately.

The audit covered staff registers of interest and gifts & hospitality; members’ declarations were not included.

Key Findings Since the 2012-13 audit, directorate registers of interest have been successfully combined into one central register, however this has not been updated since March 2014. However, related party declarations have been completed on an annual basis for Chief Officers as part of the Final Accounts process.

In the majority of cases acceptance of gifts has been appropriate, and authorised by a senior officer, and there were also instances of gifts not being accepted, which demonstrates awareness of appropriate conduct. However, not all registers have been authorised or reviewed by the appropriate senior officers.

At the time of the audit policies and guidance were unclear and they still remain difficult to locate/access, (for example, they are not easily searchable) and update and improvement was needed to clarify exactly what the council requires in respect of declarations of interests and gifts and hospitality. Monitoring and oversight by senior officers is also needed to ensure the requirements the council sets out are adhered to, and that registers of both interests and gifts are operating effectively as a mechanism for ensuring a culture of transparency and integrity within the council.

Maintenance and upkeep of the staff register of interest and registers of gifts & hospitality has recently become the responsibility of the Executive Support Assistant to the Chief Executive. While it is accepted that there will be a transitional period in the handover of the administrative process, ultimate responsibility and oversight is with senior officers to ensure controls are in place and operating effectively.

**Overall Conclusions**

It was found that the arrangements for managing risk were poor with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. Our overall opinion of the controls within the system at the time of the audit was that they provided Limited Assurance. 1 Gifts and Hospitality

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | Acceptance of gifts has not always been authorised by an appropriate officer. | Lack of scrutiny or oversight may mean gifts are accepted inappropriately resulting in the integrity of officers, or the council at large, being called into question. | | Guidance is not sufficiently clear to explain processes and requirements in respect of gifts and hospitality. | Staff may fail to understand policy requirements leading to inappropriate acceptance of gifts/hospitality. |

Findings

The 'Gifts and Hospitality Policy' is available on the intranet, and includes guidance on the types of gifts and hospitality that are acceptable as well as general guidance such as reviewing the registers and using the appropriate template, however this guidance includes a broken link to a template document, and therefore needs to be updated.

The 'Gifts and Hospitality Policy' also contains guidance relating to declarations of interest. Two paragraphs on page 2 relate to declarations of interest without any background information or explanation as to why this is included or how it relates to declarations of gifts, and moreover it is not clear either from the title of the policy or the introductory paragraphs that guidance on declaring interests is included in this document. Staff looking for this information would be unlikely at first glance to identify that it was contained within this policy.

In the majority of cases, entries on registers of gifts had been authorised by a senior officer. A number of registers contained only declarations for individual directors, and in the majority of these cases entries had not been authorised by the Chief Executive, and in one case the authorisation field contained the name of the director receiving the gift/hospitality.

Although the entries reviewed did not seem inappropriate, they should still be authorised by the chief executive to ensure gifts are not accepted inappropriately. All staff, including directors, should be made aware of the process and requirements for declaring gifts/hospitality following refresh of guidance documentation.

Agreed Action 1.1

Immediate guidance will be reviewed and updated by senior officers responsible for setting out the council’s requirements in respect of declarations of interest (under all circumstances) and gifts/hospitality to ensure:

| Priority | Responsible Officer | |----------|---------------------| | 2 | AD – Customers and Employees |

- There is a policy/guidance document setting out the background, requirements and process;
- It is clearly stated who should review entries and how frequently this should be done;
- Information and documents held on the intranet are up to date and links are not broken;
- Guidance is easy to locate and accessible by all staff.
- Guidance should continue to make clear that the responsibility for providing declarations of interest and gifts/hospitality is the responsibility of all staff.

**Agreed Action 1.2**

When guidance has been updated, it should be communicated to staff at all levels and across all directorates, and they should be required to read the updated policies to ensure that the council at large has an understanding of the purpose of both registers of interests and gifts, and their responsibilities in respect of both. This will be communicated via Buzz and as part of inductions for new staff.

| Priority | 2 | |----------|---| | Responsible Officer | AD – Customers and Employees | | Timescale | Implemented |

**Agreed Action 1.3**

Future declarations will be authorised by the appropriate officer.

| Priority | 2 | |----------|---| | Responsible Officer | ESA to Chief Exec | | Timescale | Immediate | 2 Register of Interests

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | Guidance is not sufficiently clear to explain processes and requirements in respect of declarations of interest. | Staff may fail to understand policy requirements leading to not declaring relevant interests |

Findings

Section 8 of the employee code of conduct states that ‘Employees should declare in writing to their Chief Officer any financial or non-financial interests which they consider could conflict with the interests of the Council or adversely affect the performance of their duties.’ It does not specify which employees are expected to do this as a matter of course, nor signpost to appropriate policies and guidance detailing this.

The guidance in these paragraphs indicates that, 'All relevant staff (chief officers, service managers and identified staff groups) should complete an 'interests' declaration annually', however it does not clarify which groups are 'identified staff groups' or who has responsibility for determining this.

There exist two types of conflict of interest forms: those for ‘Declaration of Staff Interests’, and for ‘Conflicts of interest’. The available guidance suggests that the two forms should be used in different situations – the former by staff asked to routinely complete declarations of financial and non-financial interests, and the latter for staff who are not asked to do this as a matter of course, but “where the employee has not been formally asked to declare their interests and/or the conflict of interest is of a temporary nature.”

The information on the intranet directs those looking for guidance on declaration of interests towards guidance on temporary conflicts of interest, despite the guidance for the latter indicating that they are considered to be two different situations. Additionally, the guidance and forms are either difficult to locate or in some cases unavailable. Where forms are available they are not linked in guidance documents, nor accessible from the same intranet page.

Declarations of interest held on the staff register are from March 2014, and therefore are out of date. The guidance (currently held in the gifts and hospitality policy, as noted in finding 1) states that, 'All relevant staff (chief officers, service managers and identified staff groups) should complete an interests declaration annually', however this does not appear to have been undertaken for 18 months. However, the annual declarations by Chief Officers had been completed as part of the process for completing the 2014-15 accounts, therefore there are records of interests declared for these staff, although this is a separate process. Responsible officers may wish to combine the processes for obtaining declarations for both finance and corporate governance purposes. Agreed Action 2.1

Guidance will be reviewed and updated by senior officers responsible for setting out the council’s requirements in respect of declarations of to ensure:

- There is a policy/guidance document setting out the background, requirements and process;
- It is explicitly stated which staff are required to complete declarations as a matter of course and what process should be followed to enable this;
- It is clearly stated who should review declarations and how frequently this should be done.
- There is one form covering all types of declaration of interest to avoid confusion;
- Information and documents held on the intranet are up to date and links are not broken;
- Guidance should continue to make clear that the responsibility for providing declarations of interest and gifts/hospitality is the responsibility of all staff.

| Priority | 2 | |----------|---| | Responsible Officer | AD – Customers and Employees | | Timescale | Implemented |

Agreed Action 2.2

Consideration will be made to combining the process for the final accounts declarations and the annual returns as part of policy/process review

| Priority | 2 | |----------|---| | Responsible Officer | AD – Customers and Employees | | Timescale | 31 July 2016 | Audit Opinions and Priorities for Actions

### Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |-----------------------|-------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

### Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.